Detecting fraudulent user accounts using graphs

Abstract

A fraud detection system is disclosed that detects potential fraudulent behavior associated a user account by identifying attributes of the user account that share attributes with one or more known fraudulent user accounts. The set of shared attributes for a user account are identified by constructing a bipartite graph comprising a set of user account nodes and a set of attribute nodes associated with the set of user account nodes. A match score for the user account is computed based on the set of shared attributes. Actions to be taken for the user account are identified based on the match score. The actions may include tagging the user account as potentially fraudulent. The actions can be used by a user (e.g., an administrator) of an organization to more intelligently determine appropriate measures to be taken for the potentially fraudulent user account.

What is claimed is: 
     
       1. A method comprising:
 accessing, by a computer system, a graph comprising a plurality of nodes, the graph stored in a memory of the computer system, the plurality of nodes including a plurality of user account nodes and a plurality of attribute nodes, each user account node in the plurality of user account nodes representing a user account, each attribute node in the plurality of attribute nodes comprising information identifying an attribute characterized by an attribute name and a value associated with the attribute name, wherein, each node in the plurality of user account nodes is connected via one or more edges to one or more attribute nodes from the plurality of attribute nodes representing one or more attributes that are associated with the user account represented by the user account node, the plurality of user account nodes comprising a set of one or more fraudulent user account nodes corresponding to one or more user accounts known as being fraudulent, the plurality of user account nodes further comprising a set of one or more monitored user account nodes corresponding to one or more user accounts being monitored; 
 for a first monitored user account node in the plurality of monitored user account nodes, identifying, by the computer system, by searching the graph stored in the memory of the computer system, a set of one or more shared attribute nodes from the set of attribute nodes, wherein each attribute node in the set of shared attribute nodes is connected via edges to both the first monitored user account node and to at least one fraudulent user account node from the plurality of fraudulent user account nodes; 
 based on the set of one or more shared attribute nodes in the graph stored in the memory of the computer system, computing, by the computer system, a match score for the first monitored user account node by:
 determining a number of attribute nodes in the set of one or more shared attribute nodes; 
 determining a number of attribute nodes connected via edges to a first fraudulent user account node from the set of fraudulent user account nodes; and 
 computing the match score based upon the number of attribute nodes in the set of one or more shared attribute nodes and the number of attribute nodes connected via edges with the first fraudulent user account node; 
 
 determining, by the computer system, based upon the match score computed for the first monitored user account node in the graph stored in the memory of the computer system, that a first monitored user account corresponding to the first monitored user account node is potentially a fraudulent user account; 
 responsive to the determining, identifying, by the computer system, an action to be performed with respect to the first monitored user account corresponding to the first monitored user account node; 
 performing, by the computer system, the action, wherein the action comprises tagging the first monitored user account as a potentially fraudulent user account; 
 receiving, by the computer system, via a data stream, monitored user account information identifying one or more new user accounts being monitored; 
 receiving, by the computer system, via the data stream, fraudulent user account information identifying one or more new user accounts known as being fraudulent; and 
 dynamically updating, by the computer system, the graph based at least in part on the monitored user account information and the fraudulent user account information. 
 
     
     
       2. The method of  claim 1 , wherein the graph is a bipartite graph and wherein no two attribute nodes in the graph have the same attribute and associated value. 
     
     
       3. The method of  claim 1 , wherein determining that the first monitored user account node is potentially a fraudulent user account comprises determining that the match score computed for the first monitored user account node meets or exceeds a preconfigured threshold. 
     
     
       4. The method of  claim 1 , wherein:
 the graph is generated in the memory of the computer system using one or more processors of the computing system; 
 the graph is a bipartite graph comprising user account nodes representing user accounts, 
 within the bipartite graph, each user account node is connected by one or more edges to one or more attribute nodes, 
 each attribute node comprises a single key-value pair, wherein the key identifies an attribute name and the value identifies an attribute value associated with the attribute name, and 
 the memory is random access memory (RAM) of the computer system. 
 
     
     
       5. The method of  claim 1 , wherein the match score is a ratio or percentage between the number of attribute nodes in the set of one or more shared attribute nodes and the number of attribute nodes connected via edges to the first fraudulent user account node. 
     
     
       6. The method of  claim 1 , further comprising:
 identifying a plurality of fraudulent user account nodes from the set of fraudulent user account nodes, wherein a fraudulent user account node from the set of fraudulent user account nodes is included in the plurality of fraudulent account nodes if the fraudulent user account node is connected to at least one attribute node in the set of one or more shared attribute nodes; 
 determining a total number of attribute nodes connected to the plurality of fraudulent account nodes; 
 determining a number of attribute nodes in the set of shared attribute nodes; and 
 computing the match score based upon the number of attribute nodes in the set of one or more shared attribute nodes and the total number of attribute nodes connected to the plurality of fraudulent user account nodes. 
 
     
     
       7. The method of  claim 1 , wherein computing the match score comprises:
 for at least one attribute node in the set of one or more shared attribute nodes:
 determining a number of user account nodes connected to the at least one attribute node; and 
 computing a weight for the at least one attribute node based upon the number of edges connected to the at least one attribute node; and 
 using the weight to compute the match score. 
 
 
     
     
       8. The method of  claim 1 , wherein computing the match score comprises:
 for the at least one attribute node:
 determining an attribute weight for the at least one attribute node; and 
 modifying the attribute weight for the at least one attribute node to generate a modified attribute weight; and 
 using the modified attribute weight to compute the match score. 
 
 
     
     
       9. The method of  claim 1  wherein computing the match score comprises:
 determining, an attribute weight for each attribute node in the set of one or more shared attribute nodes; and 
 computing the match score based upon the attribute weights determined for the attribute nodes in the set of one or more shared attribute nodes. 
 
     
     
       10. The method of  claim 1 , each attribute node in the set of one or more shared attribute nodes is connected via an edge to a first fraudulent user account node from the set of fraudulent user account nodes; and
 computing the match score comprises:
 determining an attribute weight for at least one attribute node in the set of one or more shared attribute nodes; 
 obtaining a weight assigned to the first fraudulent user account node;
 modifying the attribute weight for the at least one attribute node using the weight assigned to the first fraudulent user account node to generate a modified attribute weight; and 
 
 using the modified attribute weight to compute the match score for the monitored user account node. 
 
 
     
     
       11. The method of  claim 1  wherein the action comprises communicating a message, the message indicating that the first monitored user account is a potentially fraudulent user account. 
     
     
       12. The method of  claim 1 , wherein identifying the action further comprises:
 identifying a first action to be performed with respect to the first monitored user account when the match score for the first monitored user account node is at least a first percentage value; and 
 identifying a second action to be performed with respect to the first monitored user account when the match score for the first monitored user account node is at least a second percentage value, the first action different from the second action. 
 
     
     
       13. A system comprising:
 a memory storing a graph comprising a plurality of nodes, the plurality of nodes including a plurality of user account nodes and a plurality of attribute nodes, each user account node in the plurality of user account nodes representing a user account, each attribute node in the plurality of attribute nodes comprising information identifying an attribute characterized by an attribute name and a value associated with the attribute name, wherein, each node in the plurality of user account nodes is connected via one or more edges to one or more attribute nodes from the plurality of attributes nodes representing one or more attributes that are associated with the user account represented by the user account node, the plurality of user account nodes comprising a set of one or more fraudulent user account nodes corresponding to one or more user accounts known as being fraudulent, the plurality of user account nodes further comprising a set of one or more monitored user account nodes corresponding to one or more user accounts being monitored; and 
 one or more processors configured to perform processing, the processing comprising: 
 for a first monitored user account node in the plurality of monitored user account nodes, identify, by searching the graph stored in the memory of the system, a set of one or more shared attribute nodes from the set of attribute nodes, wherein each attribute node in the set of shared attribute nodes is connected via edges to both the first monitored user account node and to at least one fraudulent user account node from the plurality of fraudulent user account nodes; 
 based on the set of one or more shared attribute nodes in the graph stored in the memory of the system, compute a match score for the first monitored user account node by:
 determining a number of attribute nodes in the set of one or more shared attribute nodes; 
 determining a number of attribute nodes connected via edges to a first fraudulent user account node from the set of fraudulent user account nodes; and 
 computing the match score based upon the number of attribute nodes in the set of one or more shared attribute nodes and the number of attribute nodes connected via edges with the first fraudulent user account node; 
 
 determine, based upon the match score computed for the first monitored user account node in the graph stored in the memory of the system, that a first monitored user account corresponding to the first monitored user account node is potentially a fraudulent user account; 
 responsive to the determining, identify an action to be performed with respect to the first monitored user account corresponding to the first monitored user account node; 
 perform the action, wherein the action comprises tagging the first monitored user account as a potentially fraudulent user account 
 receive, via a data stream, monitored user account information identifying one or more new user accounts being monitored; 
 receive, via the data stream, fraudulent user account information identifying one or more new user accounts known as being fraudulent and 
 dynamically update the graph based at least in part on the monitored user account information and the fraudulent user account information. 
 
     
     
       14. The system of  claim 13 , wherein no two attribute nodes in the graph have the same attribute and associated value. 
     
     
       15. The system of  claim 13 , wherein:
 the graph is generated in the memory of the computer system using one or more processors of the computing system; 
 the graph is a bipartite graph comprising user account nodes representing user accounts, 
 within the bipartite graph, each user account node is connected by one or more edges to one or more attribute nodes, 
 each attribute node comprises a single key-value pair, wherein the key identifies an attribute name and the value identifies an attribute value associated with the attribute name, and 
 the memory is random access memory (RAM) of the computer system. 
 
     
     
       16. The system of  claim 13 , wherein the match score is a ratio or percentage between the number of attribute nodes in the set of one or more shared attribute nodes and the number of attribute nodes connected via edges to the first fraudulent user account node. 
     
     
       17. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
 accessing a graph comprising a plurality of nodes, the graph stored in a memory of a computer system, the plurality of nodes including a plurality of user account nodes and a plurality of attribute nodes, each user account node in the plurality of user account nodes representing a user account, each attribute node in the plurality of attribute nodes comprising information identifying an attribute characterized by an attribute name and a value associated with the attribute name, wherein, each node in the plurality of user account nodes is connected via one or more edges to one or more attribute nodes from the plurality of attributes nodes representing one or more attributes that are associated with the user account represented by the user account node, the plurality of user account nodes comprising a set of one or more fraudulent user account nodes corresponding to one or more user accounts known as being fraudulent, the plurality of user account nodes further comprising a set of one or more monitored user account nodes corresponding to one or more user accounts being monitored; 
 for a first monitored user account node in the plurality of monitored user account nodes, identifying, by the computer system, by searching the graph stored in the memory of the computer system, a set of one or more shared attribute nodes from the set of attribute nodes, wherein each attribute node in the set of shared attribute nodes is connected via edges to both the first monitored user account node and to at least one fraudulent user account node from the plurality of fraudulent user account nodes; 
 based on the set of one or more shared attribute nodes in the graph stored in the memory of the computer system, computing a match score for the first monitored user account node by:
 determining a number of attribute nodes in the set of one or more shared attribute nodes; 
 determining a number of attribute nodes connected via edges to a first fraudulent user account node from the set of fraudulent user account nodes; and 
 computing the match score based upon the number of attribute nodes in the set of one or more shared attribute nodes and the number of attribute nodes connected via edges with the first fraudulent user account node; 
 
 determining, based upon the match score computed for the first monitored user account node in the graph stored in the memory of the computer system, that a first monitored user account corresponding to the first monitored user account node is potentially a fraudulent user account; 
 responsive to the determining, identifying an action to be performed with respect to the first monitored user account corresponding to the first monitored user account node; 
 performing the action, wherein the action comprises tagging the first monitored user account as a potentially fraudulent user account: 
 receiving via a data stream, monitored user account information identifying one or more new user accounts being monitored; 
 receiving via the data stream, fraudulent user account information identifying one or more new user accounts known as being fraudulent; and 
 dynamically updating the graph based at least in part on the monitored user account information and the fraudulent user account information. 
 
     
     
       18. The non-transitory computer-readable medium of  claim 17 , wherein the graph is a bipartite graph. 
     
     
       19. The non-transitory computer-readable medium of  claim 17 , wherein:
 the graph is generated in the memory of the computer system using one or more processors of the computing system; 
 the graph is a bipartite graph comprising user account nodes representing user accounts, 
 within the bipartite graph, each user account node is connected by one or more edges to one or more attribute nodes, 
 each attribute node comprises a single key-value pair, wherein the key identifies an attribute name and the value identifies an attribute value associated with the attribute name, and 
 the memory is random access memory (RAM) of the computer system.